mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-30 14:01:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

If a server is not acknowledging SNI then don't reject early_data

Browse Source 
SNI needs to be consistent before we accept early_data. However a
server may choose to not acknowledge SNI. In that case we have to
expect that a client may send it anyway. We change the consistency
checks so that not acknowledging is treated more a like a "wild card",
accepting any SNI as being consistent.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4738)
This commit is contained in:
Matt Caswell 2017-11-14 15:14:51 +00:00
parent 3b5873567d
commit 281bf2332c
2 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ssl/statem/extensions.c
View File

@ -911,8 +911,6 @@ static int final_server_name(SSL *s, unsigned int context, int sent,
case SSL_TLSEXT_ERR_NOACK:
s->servername_done = 0;
if (s->server && s->session->ext.hostname != NULL)
s->ext.early_data_ok = 0;
return 1;
default:

11
test/sslapitest.c
View File

@ -1961,13 +1961,11 @@ static int test_early_data_not_sent(int idx)
return testresult;
}
static const char *servhostname;
static int hostname_cb(SSL *s, int *al, void *arg)
{
const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
if (hostname != NULL && strcmp(hostname, servhostname) == 0)
if (hostname != NULL && strcmp(hostname, "goodhost") == 0)
return SSL_TLSEXT_ERR_OK;
return SSL_TLSEXT_ERR_NOACK;
@ -2024,7 +2022,6 @@ static int test_early_data_psk(int idx)
&serverssl, &sess, 2)))
goto end;
servhostname = "goodhost";
servalpn = "goodalpn";
/*
@ -2069,7 +2066,11 @@ static int test_early_data_psk(int idx)
* Set inconsistent SNI (server detected). In this case the connection
* will succeed but reject early_data.
*/
servhostname = "badhost";
SSL_SESSION_free(serverpsk);
serverpsk = SSL_SESSION_dup(clientpsk);
if (!TEST_ptr(serverpsk)
|| !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost")))
goto end;
edstatus = SSL_EARLY_DATA_REJECTED;
readearlyres = SSL_READ_EARLY_DATA_FINISH;
/* Fall through */